Hong Kong’s Office of the Privacy Commissioner for Personal Data (PCPD) has completed its investigation into the Worldcoin project and determined that the project’s collection of biometric data violated the Personal Data (Privacy) Ordinance (PDPO). In a notice issued on May 22, Privacy Commissioner Ada Chung Lai-ling ordered an immediate halt to all Worldcoin operations in Hong Kong involving the collection of iris and facial images.
The PCPD’s investigation, which began in January 2024, aimed to assess whether Worldcoin’s methods of identity verification posed significant risks to personal data privacy and compliance with the PDPO. During the investigation, the PCPD conducted undercover visits to six Worldcoin operation sites between December 2023 and January 2024.
The investigation revealed that the collection of facial images was unnecessary for verifying the authenticity of participants, as this verification could be done in person by the operators at the locations. Worldcoin was criticized by the PCPD for not providing sufficient information, preventing participants from making informed decisions and giving genuine consent.
An important issue was that Worldcoin’s privacy notice was not available in Chinese, making it difficult for non-English speakers to understand the project’s policies, practices, terms, and conditions. Additionally, the operators at the scanning sites did not adequately explain the documents to participants or ensure their understanding, nor did they inform participants of the potential risks associated with sharing their biometric data.
Based on these findings, the PCPD concluded that the collection of facial and iris images was both unfair and unlawful, violating Hong Kong’s data protection principles. Furthermore, the retention of this sensitive biometric data for up to ten years for AI model training purposes was deemed unjustifiable.
Worldcoin disclosed that during its operations in Hong Kong, 8,302 individuals had their facial and iris images scanned for verification. The project, which was launched in 2021, attracted over two million sign-ups before its official launch in July 2023. However, Worldcoin has faced regulatory scrutiny worldwide due to privacy concerns, resulting in the suspension of its services in Kenya and a pause in iris scans in India.
